Per request of the PHP security team, CVE IDs have been assigned, documented in each of the bugs, and add the info to the PHP changelogs in the project's website.
PHP changelogs
https://github.com/php/web-php/commit/a0213e3670a68468d5769543ac15f9dad6a01bb9
https://github.com/php/web-php/commit/404840cbf264fbf784e9c459ad22d0e08a0515bf
https://github.com/php/web-php/commit/6da4c382a457a534a6fb750f594c6d3110616dc5
https://github.com/php/web-php/commit/adca7327e2c7747c32bce65f8c5ca010dcc364e5
https://github.com/php/web-php/commit/9c294fcf2ea2223c8a78af444ec4f023ed3c9667
Changes are visible at
http://www.php.net/ChangeLog-5.php
http://www.php.net/ChangeLog-7.php
